GET and POST /api/v1/repos/:owner/:name/app/notes: an app's admin lists the forge button's notes, hides one, bans or unbans its sender #7218

For: moderating what visitors send from an app's forge button is one API call, as it already is on the page and in the terminal.

Today ownerNotes, moderateNote and unbanSender (src/actions/app_notes.ts:247-316) are reached only from src/web/studio/notes.ts and src/tui/screens/notes.ts.

Done:

• [ ] A new src/http/api/app_notes.ts, registered with one line beside reportRoutes. GET …/app/notes answers { notes, banned }, as ownerNotes returns them. POST …/app/notes/:id/hide, …/ban and …/unban each answer the note, and need an rw token and a same-origin or bearer request.
• [ ] Only an admin of the repository may use them. Anyone else gets forbidden (403). A repository that is not an app, or an unknown note, is not_found.
• [ ] The routes are in the OpenAPI document (new files under src/contract/openapi/routes/), and test/openapi.test.ts passes.
• [ ] A new test/api-app-notes.test.ts sends a note through the forge button's endpoint (src/apps/feedback.ts), then lists, hides, bans and unbans it over the API. It also asserts that a writer who is not an admin, and a read-only token, are refused.

Files: src/http/api/app_notes.ts, OpenAPI route files, one test. Risk: low. The rules stay in src/actions/app_notes.ts.